How to run CCTV in Thailand without breaching the PDPA You can run CCTV, but footage of people is protected personal data. The Thailand Data Protection Guidelines (TDPG) 4.0 recommend telling people before or at the time of recording with a clear sign before the camera zone, naming the controller, the DPO contact if any, the purpose, the lawful basis and a short summary of rights, plus a link or QR code to the full notice. Rely on legitimate interests, limit camera angles and retention, and log who accesses footage.
A restaurant owner installs eight cameras around the shop to deter theft. They record non-stop until the hard drive fills up, there is no sign at the entrance, and every staff member can replay footage on their phone. One evening a clip of two tables arguing ends up in the neighbourhood group chat.
What you need to know
The 5 points that matter most, drawn from the law and guidance cited at the end of this guide. Read just this part and you can decide your next move.
- People must be told before or at the time their images are collected, using a sign that is easy to see before they enter the camera zone.
- TDPG 4.0 recommends a layered notice: a short first-layer sign and a full privacy notice reached by link or QR code.
- For security cameras, TDPG 4.0 points to legitimate interests as the lawful basis and recommends a Legitimate Interest Assessment (LIA).
- Audio recording or facial analysis raises the risk, and TDPG 4.0 recommends a DPIA.
- TDPG 4.0 gives 15–30 days as an example retention period, alongside limited camera angles, access logs and encrypted or locked files.
How to do it in 6 steps
Work through these 6 steps in order. Each one is written so a team in a Thai organisation can act on it without waiting for a consultant, and keep the evidence an auditor will ask for.
- Define the purposeWrite down why you use cameras, such as security or crime prevention, and record the activity in your Record of Processing Activities (RoPA). The purpose drives camera angles and how long you keep footage.
- Pick the lawful basis and run an LIATDPG 4.0 points to legitimate interests for CCTV and recommends a Legitimate Interest Assessment (LIA) to weigh your interest against the privacy of people on camera.
- Point cameras only where neededAvoid collecting more than you need, especially in very private areas, and do not switch on audio recording or facial analysis without doing a DPIA first.
- Put up signs before the camera zonePlace signs or stickers at entrances and in covered areas naming the controller, the DPO contact (if any), the purpose, the lawful basis and a short summary of rights, with a link or QR code to the full notice.
- Set retention and auto-overwriteChoose a period that fits your risk; TDPG 4.0 gives 15–30 days as an example. If an incident is reported to the police, keep the relevant clips until the police collect them as evidence.
- Control who sees footageAssign viewer roles, log access to CCTV files, encrypt or lock the files and train security staff. If a guard company runs the cameras, put a processor agreement in place.
Is CCTV footage personal data under the PDPA?
Yes. TDPG 4.0 explains that personal data stays protected whether it sits in an IT system, a CCTV system or paper files, because protection covers both automated and non-automated processing.
TDPG 4.0 also lists CCTV among activities that may amount to monitoring people's behaviour, and treats collection by observation, such as CCTV, as direct collection that calls for a privacy notice.
What should a CCTV sign say?
TDPG 4.0 recommends a two-layer notice. The first layer is a clear warning sign before people enter the camera zone; the second layer holds the rest of the details somewhere easy to reach, such as the reception desk, a web page linked from the sign, or a scannable code.
- Who the data controller is, or its representative (if any).
- How to contact the Data Protection Officer (DPO), if you have one.
- The purpose of the cameras and the lawful basis.
- A short summary of data subject rights.
How long should you keep CCTV footage?
TDPG 4.0 does not set one number for every business, but gives 15–30 days as an example of limited retention and asks you to match the period to your needs.
In TDPG 4.0's examples, a bank with cameras at ATMs to prevent fraud may need footage for several weeks, because suspicious transactions often surface only when customers see their bank statements, while a restaurant may need a shorter period. If an incident has been reported to the police, keep the footage until they collect it as evidence.
Who is responsible when a security company runs your cameras?
In TDPG 4.0's example, when the client decides where, when and how long to record, and the security company records on the client's instructions without deciding the purpose, the client is the data controller and the security company is the data processor.
As the controller, the property owner should own the signage and retention rules, and should have an agreement requiring the security company to follow instructions and keep footage secure.
Common problems and how to fix them
Most organisations slip on the same 3 points. The table shows how to fix each one yourself, and how AIPDPA gets it done faster with the evidence in place.
| Problem | Fix |
|---|---|
| ✗ No sign, or just a camera sticker that tells people nothing. | ✓ Make the first-layer sign name the controller, contact details, purpose, lawful basis and rights, with a QR code to the full notice. AIPDPA includes a CCTV privacy notice template in Thai and English, and approved copies carry a QR code anyone can verify. |
| ✗ Keeping footage until the hard drive fills up. | ✓ Set a retention period that fits your needs, such as the 15–30 days TDPG 4.0 uses as an example, and let the recorder overwrite automatically. AIPDPA's retention module keeps your retention rules and review schedule, so the period in your notice matches the one you actually run. |
| ✗ Turning on face recognition or audio without assessing the risk. | ✓ TDPG 4.0 says audio recording or facial analysis raises the risk and calls for a DPIA. AIPDPA's DPIA workspace gives you a questionnaire, a risk register and sign-off, so the assessment is finished before go-live. |
CCTV signs and notices, ready in minutes
AIPDPA's CCTV privacy notice template, in Thai and English, gives you a ready-to-use notice and a QR-verifiable approved copy. See the demo account, no sign-up needed.
Included in every plan, from 2,900 THB/year · demo account, no sign-up
Frequently asked questions
The questions people search for most on this topic. Each answer is short, direct and stands on its own.
Do I need customers' consent to run CCTV in my shop?
For security cameras, TDPG 4.0 points to legitimate interests as the lawful basis, together with an LIA and a clear sign before or at the time of recording. For publishing images in public media, TDPG 4.0's condominium example uses consent.
What must a CCTV warning sign include?
Following TDPG 4.0, the first-layer sign should say who the controller is, how to reach the DPO (if any), the purpose and lawful basis, and a short summary of rights, with a link or QR code to the full notice.
Can we use cameras with face recognition?
TDPG 4.0 says facial analysis or audio recording raises the risk of a personal data breach and recommends a DPIA before you switch it on.
Can a condominium or housing estate install CCTV?
Yes. TDPG 4.0's example has the juristic person relying on legitimate interests for security, limiting camera coverage to what is necessary, keeping a RoPA and training security staff.
Is TDPG 4.0 the law?
No. TDPG 4.0 is guidance that explains how to put the PDPA into practice, not a statute. Following it helps you show that your CCTV set-up is reasonable.
Sources
This guide relies on 6 sources. Statutes are cited by section or clause; guidelines and standards are guidance, not law.
- Thailand Data Protection Guidelines (TDPG) 4.0, para. A23 — data in CCTV systems is protected (guidance, not statute)
- Thailand Data Protection Guidelines (TDPG) 4.0, para. E14 — privacy notice for direct collection, including observation by CCTV
- Thailand Data Protection Guidelines (TDPG) 4.0, para. E24 — notice through signage
- Thailand Data Protection Guidelines (TDPG) 4.0 — example CCTV notice using a layered approach
- Thailand Data Protection Guidelines (TDPG) 4.0 — CCTV processing example (lawful basis, LIA, DPIA and supporting measures)
- Thailand Data Protection Guidelines (TDPG) 4.0 — CCTV retention examples and the security company as processor
The law cited here comes from AIPDPA's legal knowledge base, transcribed from the Royal Gazette · This is general information; if your situation has unusual facts, our lawyers can review it with you.
Tools and services that help right now
Want to do it yourself, faster? Use the tools in AIPDPA. Want a lawyer to handle it, or to learn the skill yourself? Pick the service in our network that fits.
40 ready-to-use documents in Thai and English, with all 88 AI-added clauses confirmed, filled from your registers, with a QR to verify the approved copy.
Join the waitlist →The register fills itself from your org chart, picks the lawful basis with its section, and prints a Section 39 report in one click.
Join the waitlist →Questionnaire, risk register and sign-off in one place, with a printable report.
Join the waitlist →Retention rules, review schedules and disposal logs — the Section 37(3) evidence auditors always ask for.
Join the waitlist →A lawyer-led team checks your readiness and sets up PDPA end to end — ideal for SMEs without the time.
See the service →
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)
Keep reading
Guides that usually come next after this one. Read them in the order your organisation needs.